One envelope,
eight jobs

The note is just signed JSON. There is no more to it than this.

{
  "id":         "3f9a…",
  "pubkey":     "a41c…",
  "created_at": 1789600000,
  "kind":       9,
  "tags":       [["h","engineering"]],
  "content":    "RC is ready",
  "sig":        "8b02…"
}

The signature proves one thing: this key produced these exact bytes. It says nothing about whether any of it is true.

this is the Nostr event format — every Buzz feature is built on this shape

In Nostr, that server is called a relay. Ours does far more than relay.

Almost everything that confuses people about Buzz comes from expecting the left-hand box and getting the right-hand one.

Three kinds of author. The third one surprises people.

Remember the third one. When a workflow posts a message on your behalf, it is the relay's signature on it, not yours.

Before the server can decide, it reads two fields.

A message in a channel, mentioning an agent. Three fields, and the whole rest of the talk follows from them.

Box two is a list. If your kind is not on it, you are refused.

This is one function in one file, and it is the front door to the entire product. Everything we ever add has to be added to it.

the list crates/buzz-relay/src/handlers/ingest.rs — required_scope_for_kind()

What the relay actually checks, in plain language.

evidence crates/buzz-relay/src/handlers/ingest.rs — ingest_event_inner()

Buzz has names for 134 kinds. You can write 84 of them.

A list of kind numbers is a dictionary, not a menu. Two-fifths of the words in it are not yours to say.

counted from crates/buzz-core/src/kind.rs × ingest.rs — re-checked by npm run verify

Now we can answer the question from the first slide.

Some notes are records of something that happened. Some notes are instructions to make something happen. They look identical.

evidence handlers/relay_admin.rs — 9030–9033 mutate membership directly

There are seven places an accepted note can end up.

"Everything is an event" is a slogan, not a description. A dump of every event is not a backup of Buzz.

evidence handlers/{ingest,command_executor,relay_admin,report,product_feedback,moderation_commands}.rs

Sarah changes her profile picture twice. How many notes exist?

Latest wins by the author's own claimed timestamp — which is why that 15-minute clock check exists.

evidence crates/buzz-db/src/store/replaceable.rs

One note. Five people ask for it. Five different answers.

Encryption hides the contents. These gates hide the fact that the note exists at all.

evidence crates/buzz-core/src/kind.rs — P_GATED_KINDS, RESULT_GATED_KINDS

Four rules about who may read, each checked in five places.

Sharing a persona is a tag, not a content change — so turning it on does not alter the note's contents, and device sync does not see a phantom edit.

evidence crates/buzz-core/src/kind.rs — AUTHOR_ONLY · P_GATED · RESULT_GATED · SHARED_GATED_KINDS

Three different things are watching Sarah's message.

Sarah pressed enter once. Three independent systems decided, separately, whether to care.

You already know the whole model. Here it is with names.

Six independent contracts. Passing one tells you nothing about the other five. From here on, this strip is the map.

the rest of the deck is this strip, lit differently

One envelope. Eight completely different jobs.

The number tells you which job. The code behind it does the job. That is the first of our three takeaways.

evidence crates/buzz-core/src/kind.rs · handlers/side_effects.rs

"The agent exists" means seven different things.

Delete removes some of these. That is why a deleted agent still shows up in autocomplete.

evidence .ai/analyses/002 · crates/buzz-core/src/kind.rs · docs/remote-agents.md

The keypair is the identity. Everything else is a representation.

Deployment should be reconciliation toward one live instance per key — not "create another process."

evidence docs/nips/NIP-AP.md · docs/remote-agents.md · crates/buzz-core/src/kind.rs

Agent state is the most gated data in the system.

Encryption protects the content. The gates protect the fact that the event exists.

evidence docs/nips/NIP-AP.md · NIP-AM · NIP-AE · crates/buzz-core/src/kind.rs

Absence and failure are not the same state.

Session creation is never blocked by this. But a failed read is never allowed to look like an empty one.

evidence crates/buzz-acp/src/engram_fetch.rs

Two gates decide whether an agent wakes. Neither is the relay's.

A mention from a non-owner is dropped by the harness, silently — and the relay's records show a perfectly successful delivery.

evidence crates/buzz-acp/src/{relay,filter,queue,pool,acp}.rs · config.rs — RespondTo::OwnerOnly is the default

One identity. N workers. The relay cannot tell them apart — by design.

evidence crates/buzz-acp/README.md · crates/buzz-acp/src/{pool,queue}.rs · desktop managed-agent defaults

Four things we call "running." One survives a restart.

evidence ARCHITECTURE.md · crates/buzz-db/src/store/workflow.rs · crates/buzz-acp/src/pool.rs

A mention arrives mid-turn. Four policies, and three of them cancel.

"Running" disagrees with itself here too: the queue says in-flight, the ACP client says prompt active, the adapter may or may not expose a live run to steer. That disagreement has an error name.

evidence crates/buzz-acp/src/config.rs — MultipleEventHandling · DedupMode::Queue required

A workflow exists twice, and the two copies can drift.

evidence crates/buzz-workflow/src/lib.rs · ARCHITECTURE.md

The trigger matcher is narrower than the word suggests.

Workflow execution kinds, command kinds, gift wraps and relay-signed workflow output are all excluded from triggering. That is the loop guard.

evidence crates/buzz-workflow/src/lib.rs — trigger_matches_kind() · schema.rs — TriggerDef

Seven actions in the schema. Four of them work.

Schema, storage, API, CLI, UI and tokens all exist for approvals. The executor cannot yet persist and resume a suspended run.

evidence crates/buzz-workflow/src/executor.rs · lib.rs — RunStatus::Failed, code "approval_not_supported"

The relay signs workflow output as itself.

{
  "kind": 9,
  "pubkey": "<relay key>",
  "tags": [
    ["h", "eng-channel"],
    ["buzz:workflow", "true"],
    ["buzz:workflow-owner", "<owner>"],
    ["buzz:workflow-mention", "<agent>"],
    ["p", "<agent>"]
  ],
  "content": "P1 detected — @Ops please triage"
}

Untrusted trigger text can produce a p tag. It cannot produce a buzz:workflow-mention. Authority must not be launderable.

evidence crates/buzz-relay/src/workflow_sink.rs — resolve_mention_pubkeys()

One guarantee. Five things you were hoping for.

evidence crates/buzz-relay/src/handlers/event.rs — dispatch_persistent_event() spawns and returns

Now you are adding a kind. Fill in the six gates.

Eleven answers before a number. The number is the last decision, not the first.

Four places we can extend. They are not equally expensive.

The boundary rule: external service when it can safely consume accepted events and publish results. Patch the relay when correctness or confidentiality must be enforced before publication, storage, or disclosure.

governance UPSTREAM.md — kinds, auth and agent authorization changes require special review on every weekly sync

Three candidates, deliberately at different costs.

evidence crates/buzz-auth/src/scope.rs — JobsRead/JobsWrite defined, unused · handlers/command_executor.rs — atomicity note

Cost is not effort. Cost is what we carry every Monday.

The 50 named kinds you cannot write.

regenerate npm run verify — asserts this partition against crates/buzz-core/src/kind.rs

Which file owns which gate.